Extracted

• • Target

    c49d2803464e2eecb118dc95776fabee0f3addd7ae31505c42a3bd839c973696

  • Size

    2.3MB

  • MD5

    51eb099e680eb872a3619c63edcfdc5a

  • SHA1

    3a2abc690a922190b9d5d61654068df37ea4d72a

  • SHA256

    c49d2803464e2eecb118dc95776fabee0f3addd7ae31505c42a3bd839c973696

  • SHA512

    bdac8e9e1ce5a2fd8709296d5279f7a31a97a1f81131a5f1b821203e2b4a23e925d80348a1988c8715a0d5209b36596bf74174108ecce5675f42d9550341b159

  • SSDEEP

    49152:CGY5918NqwTEgTcQUEnurFnLTHLpWGBM/OS7xpJBKn8Q/UgVR:ThTPUumfM/bBBO3/UeR

  Score

  10^/10

  riseproevasionstealer

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2